CmdID

CmdID / Techniques

T1106 Native API

Adversaries may interact with the native OS application programming interface (API) to execute behaviors. MITRE ATT&CK

2 programs on CmdID 5 Sigma rules T1106 on attack.mitre.org

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
cdb.exeits Sigma rulesmshta.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first
highHackTool - RedMimicry Winnti Playbook ExecutionAlexander Rausch · Windows
highHackTool - WinPwn ExecutionSwachchhanda Shrawan Poudel · Windows
highPotential WinAPI Calls Via CommandLineNasreddine Bencherchali (Nextron Systems) · Windows
highSuspicious Mshta.EXE Execution PatternsFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
mediumPotential Binary Proxy Execution Via Cdb.EXEBeyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems) · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

To list all the service information for processes on the remote computer srvmain, which has a DLL name beginning with ntdll, type on the page for tasklist

tasklist /s srvmain /svc /fi "MODULES eq ntdll*"Identify

An example is here when CmdID’s reading of it names T1106: a Sigma rule it trips is tagged with it, or its abuse is documented as it.